MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7ccd7d9ddd2d7fac9a00165b430c3e64b411e57fc7853c23b9938ad8df725b48. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

AgentTesla

Vendor detections: 5

Intelligence 5 IOCs YARA 2 File information Comments

SHA256 hash:	7ccd7d9ddd2d7fac9a00165b430c3e64b411e57fc7853c23b9938ad8df725b48
SHA3-384 hash:	bd538e001990fcf08f98e238cf0d31a09c0a28691535f79289dd11ee8d1a8658f9c159ba897aae3f5ed9e5d74924e897
SHA1 hash:	ef802f9609520e71a73cd451080a5146dc3f04c9
MD5 hash:	783bc33207042a9901218b42773a6cd7
humanhash:	king-seven-illinois-single
File name:	Inv. & SOA.r09
Download:	download sample
Signature	AgentTesla Create hunting rule
File size:	582'830 bytes
First seen:	2023-06-30 07:20:39 UTC
Last seen:	Never
File type:	r09
MIME type:	application/x-rar
ssdeep	12288:5b52nCQRvYf/N/lzeRReLk7DImXZFVzwRyVQDcboSKvJhAj:BOCAvG1/Re8k7DIA/2ReQDjJhw
TLSH	T175C42333D05216643E73FDAD9CBA2A5B4924B655C81D87CEBC3B1E8408D1C48FDA2DD6
TrID	61.5% (.RAR) RAR compressed archive (v5.0) (8000/1) 38.4% (.RAR) RAR compressed archive (gen) (5000/1)
Reporter	cocaman
Tags:	AgentTesla r09

cocaman

Malicious email (T1566.001)
From: "Sekhar Kadel <finance_my@unigreating.com.cn>" (likely spoofed)
Received: "from unassigned.quadranet.com (unknown [69.174.100.146]) "
Date: "30 Jun 2023 07:16:57 -0700"
Subject: "=?UTF-8?B?5o+Q6LSnIOWbnuWkjTogUkU6IEtSTVU2NjQ0NTUvNSAtIFRVVElDT1JJTiBfWU1IRyAvLyA0dGggUE8jUVNCLTE4MDIxMQ==?=, QSB-180210"
Attachment: "Inv. & SOA.r09"

Intelligence

File Origin

# of uploads :

# of downloads :

137

Origin country :

File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:	Inv. & SOA.exe
File size:	902'144 bytes
SHA256 hash:	9618f331b2bbad7bbb947cedaad7dd744169318cb11212e05089c6f4b8983400
MD5 hash:	be042f209b58598fe1e6a1dd0069338f
MIME type:	application/x-dosexec
Signature	AgentTesla

Vendor Threat Intelligence

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

comodo packed

Link:

https://www.filescan.io/uploads/649e8262204315fbc16bbf2b/reports/219e3533-3b88-4379-b56b-c6b267320c43/overview

Verdict:

Malicious

Labled as:

Mal/DrodRar

Link:

https://www.hybrid-analysis.com/sample/7ccd7d9ddd2d7fac9a00165b430c3e64b411e57fc7853c23b9938ad8df725b48

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/7ccd7d9ddd2d7fac9a00165b430c3e64b411e57fc7853c23b9938ad8df725b48/

Threat name:

Win32.Spyware.Negasteal

Status:

Malicious

First seen:

2023-06-30 07:20:42 UTC

File Type:

Binary (Archive)

Extracted files:

AV detection:

18 of 36 (50.00%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ptgx3ho5fv72zgqacznugdb6ms2bdzl7y6ctyi5zsofnrx3slnea._file

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.